---
schema_version: "1"
id: a03d6b9dddd2509d04f4c8cb20bf22d3b625e5b48dc58abb38680c403de51216
title: GraphQL Schema Validation Policy
collection: mulesoft
version: current
locale: en-us
portal_url: https://docs.salesforce.com/mulesoft/current/en-us/gateway/1.13/policies-included-graphql-schema-validation.md
canonical_url: https://docs.mulesoft.com/gateway/1.13/policies-included-graphql-schema-validation
source_site: docs.mulesoft.com
content_type: documentation
content_hash: ee759edd95fafe5e05dd1d5b744b3faa0df0e9eb235c324892a0d008e8d90768
description: MuleSoft Documentation Site
release: "1.13"
latest: false
---
---
product: Omni Gateway
version: 1.13
keywords: graphql, schema validation, api gateway, flex gateway, gateway, policy
---

# GraphQL Schema Validation Policy

> For the full documentation index, see: https://docs.mulesoft.com/llms.txt

<table><colgroup><col> <col></colgroup><tbody><tr><td><p><strong>Policy Name</strong></p></td><td><p>GraphQL Schema Validation</p></td></tr><tr><td><p><strong>Summary</strong></p></td><td><p>Validates incoming GraphQL operations against a GraphQL schema definition</p></td></tr><tr><td><p><strong>Category</strong></p></td><td><p>Security</p></td></tr><tr><td><p><strong>First Omni Gateway version available</strong></p></td><td><p>v1.13.0</p></td></tr><tr><td><p><strong>Release Notes</strong></p></td><td><p><a href="https://docs.mulesoft.com/release-notes/gateway/policies/graphql-schema-validation-release-notes">GraphQL Schema Validation</a></p></td></tr><tr><td><p><strong>Returned status codes</strong></p></td><td><p>400 - The operation doesn’t satisfy the schema. When <strong>Block request</strong> is enabled, the JSON response includes GraphQL-style <code>errors</code> with a validation message.</p></td></tr></tbody></table>

## Summary

The GraphQL Schema Validation policy applies standard GraphQL validation rules, including field and
argument correctness, fragments, directives, unions, interfaces, and other specification rules.

The policy loads the schema in these ways:

- If `source` is `context`, Flex Gateway automatically loads the schema file from the API asset in
  Anypoint Exchange.

- If `source` is `inline`, provide the schema text directly in the policy configuration. This is
  required for local mode or environments not connected to Exchange.

If the document includes an `@link` to the Apollo Federation specification URL, Omni Gateway uses
this schema to validate all incoming requests.

After Omni Gateway extracts inline GraphQL operation text from the request, the policy runs
validation. If Omni Gateway can’t resolve normal operation text, such as persisted query flows, it
skips these checks and logs a warning before it forwards the request to the upstream.

## Configuring Policy Parameters

### Omni Gateway Local Mode

When you apply the policy via declarative configuration files, Refer to the following policy
definition and table of parameters:

\- policyRef: name: graphql-schema-validation-flex config: source: <string> // OPTIONAL, default:
context; values: "context" or "inline" schema: <string> // REQUIRED when source is inline; omit when
source is context blockOperation: <boolean> // OPTIONAL, default: true

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Parameter</th><th>Required</th><th>Default Value</th><th>Description</th></tr></thead><tbody><tr><td><div><div><p><code>source</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p><code>context</code></p></div></div></td><td><div><div><p>Where Omni Gateway retrieves the schema for validation. If set to <code>context</code>, Omni Gateway automatically loads the schema file from the API asset in Anypoint Exchange. If set to <code>inline</code>, provide the schema text directly in the policy configuration. This is required for local mode or environments not connected to Exchange.</p></div></div></td></tr><tr><td><div><div><p><code>schema</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p>NA</p></div></div></td><td><div><div><p>The schema text used for validation. Required when <code>source</code> is set to <code>inline</code>.</p></div></div></td></tr><tr><td><div><div><p><code>blockOperation</code></p></div></div></td><td><div><div><p>No</p></div></div></td><td><div><div><p><code>true</code></p></div></div></td><td><div><div><p>How Omni Gateway handles requests that fail validation. If <code>true</code>, Omni Gateway blocks the request and returns a <code>400</code> Bad Request. If <code>false</code>, Omni Gateway logs a warning and forwards the request to your backend.</p></div></div></td></tr></tbody></table>

#### Resource Configuration Example

This example validates against a minimal inline schema:

```yaml
- policyRef:
    name: graphql-schema-validation-flex
  config:
    source: inline
    blockOperation: true
    schema: |
      type Query {
        hello: String
      }
```

### Managed Omni Gateway and Omni Gateway Connected Mode

When you apply the policy from the UI, the following parameters are displayed:

<table><colgroup><col> <col> <col> <col></colgroup><thead><tr><th>Field</th><th>Description</th><th>Default Value</th><th>Required</th></tr></thead><tbody><tr><td><div><div><p>Block request</p></div></div></td><td><div><div><p>If enabled and the operation doesn’t conform to the schema, Omni Gateway returns a <code>400</code> error. If disabled, Omni Gateway logs a warning and forwards the request.</p></div></div></td><td><div><div><p>Enabled</p></div></div></td><td><div><div><p>Yes</p></div></div></td></tr></tbody></table>

## See Also

- [Inbound Policies Directory](https://docs.mulesoft.com/gateway/1.13/policies-included-directory)

- [Schema Validation Policy](https://docs.mulesoft.com/gateway/1.13/policies-included-schema-validation)

- [Securing Omni Gateway Instances with Policies](https://docs.mulesoft.com/gateway/1.13/gateway-secure-apis)